Extracted

• • Target

    XClient.exe

  • Size

    283KB

  • MD5

    94d7570a4d6becf9ccccac918fc7a525

  • SHA1

    8e9fa909a7f38b1f4481ee880340c96aa03a9a84

  • SHA256

    6639082eb40e90f37ad92b3616c2040937355c5196ba241340cb1e8719d098df

  • SHA512

    d97b0b2c758e3288ffbacf1111b621f0530ad152830b17795a8734e4d30cd85c5578d94983f6668222028e45095582a05a41033df0bf1061fb18124fe7fa8e7f

  • SSDEEP

    3072:c43Cklb4wOyopUd87kREhYyZxbHrR6Y7zjokEtNaaayMakxiJ+UZeQnjm9sjSwkm:bpbVoA8oKhsrx8iJZeQiWsVCA2aAN0F

  Score

  10^/10

  xwormexecutionpersistencerattrojandiscovery

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2behavioral3behavioral4behavioral5